Multi-factor authentication devices

ABSTRACT

A device may receive a request from a first user device to access a protected device. The device may verify a user identity of a user of the first device based on user credentials and determine that an authentication code is needed to authenticate the request to access the protected device. The device may dynamically generate multiple codes and transmit the multiple codes to a second user device associated with the user identity of the user of the first device. A first code, of the multiple codes, may correspond to a correct authentication code needed to authenticate the request to access the protected device. The device may transmit a message including an instruction for identifying the correct authentication code from among the multiple codes, receive a second code from the first device, compare the second code and the first code, and selectively authenticate the request to access the protected device.

BACKGROUND

Multi-factor authentication is a method of authenticating a user'sclaimed identity in which a user is granted access to a protectedresource (e.g., an automated teller machine (ATM), web access toinformation regarding a bank account, etc.) only after successfullypresenting two or more pieces of evidence, or factors, to anauthentication service. Factors the user may present for authenticationmay include knowledge-based factors (e.g., a username, password, etc.,based on information the user knows), possession-based factors (e.g., adevice, a token, etc., based on something in the user's possession), orinherency-based factors (e.g., a fingerprint, voice, biometricinformation, etc., based on something the user is).

SUMMARY

According to some possible implementations, a method may includereceiving, by a processor, a request from a first user device to accessa protected device. The request may be from the first user device andinclude user credentials. The user credentials may be associated with auser identity of a user of the first user device. The method may includeverifying, by the processor, the user identity of the user of the firstuser device based on comparing the user credentials received in therequest from the first user device and a user profile. The method mayinclude determining, by the processor, that an authentication code isneeded to authenticate the request received from the first user deviceto access the protected device based on verifying the user identity ofthe user of the first user device. The method may include dynamicallygenerating, by the processor, a plurality of codes based on determiningthat the authentication code is needed to authenticate the requestreceived from the first user device to access the protected device. Afirst code, of the plurality of codes, may correspond to a correctauthentication code needed to authenticate the request received from thefirst user device to access the protected device. The method may includedetermining, by the processor, a second user device associated with theuser identity of the user of the first user device after verifying theuser identity. The method may include transmitting, by the processor,the plurality of codes to the second user device associated with theuser identity of the user of the first user device. The method mayinclude transmitting, by the processor, a message including aninstruction for identifying the correct authentication code from amongthe plurality of codes. The method may include transmitting, by theprocessor and to the first user device, an authentication request thatincludes a request for the correct authentication code. The method mayinclude receiving, by the processor and from the first user device, aresponse to the authentication request that includes a second code,comparing, by the processor, the second code and the first code, andselectively authenticating, by the processor, the request from the firstuser device to access the protected device, based on a result ofcomparing the second code and the first code, to selectively grant thefirst user device access to the protected device.

According to some possible implementations, a device may include one ormore memories, and one or more processors, communicatively coupled tothe one or more memories, to receive a request from a first user deviceto access a protected device. The request may be received from the firstuser device and include user credentials. The user credentials may beassociated with a user identity of a user of the first user device. Theone or more processors may verify the user identity of the user of thefirst user device based on comparing the user credentials received inthe request from the first user device and a user profile. The one ormore processors may determine that an authentication code is needed toauthenticate the request received from the first user device to accessthe protected device based on verifying the user identity of the user ofthe first user device. The one or more processors may dynamicallygenerate a plurality of codes based on determining that theauthentication code is needed to authenticate the request received fromthe first user device to access the protected device. A first code, ofthe plurality of codes, may correspond to a correct authentication codeneeded to authenticate the request received from the first user deviceto access the protected device. The one or more processors may determinea second user device associated with the user identity of the user ofthe first user device after verifying the user identity of the user ofthe first user device. The one or more processors may transmit theplurality of codes to the second user device associated with the useridentity of the user of the first user device. The one or moreprocessors may transmit a message to the first user device. The messagemay include an instruction for identifying the correct authenticationcode from among the plurality of codes. The message may be configuredfor display on the first user device. The one or more processors maytransmit, to the first user device, an authentication request thatincludes a request for the correct authentication code, receive, fromthe first user device, a response to the authentication request thatincludes a second code, compare the second code and the first code, andselectively authenticate the request from the first user device toaccess the protected device based on a result of comparing the secondcode and the first code to selectively grant the first user deviceaccess to the protected device.

According to some possible implementations, a non-transitorycomputer-readable medium may store one or more instructions that, whenexecuted by one or more processors, cause the one or more processors toreceive a request from a first user device to access a protectedresource. The request may be received from the first user deviceincludes user credentials. The user credentials may be associated with auser identity of a user of the first user device. The one or moreinstructions, when executed by the one or more processors, may cause theone or more processors to verify the user identity of the user of thefirst user device based on comparing the user credentials received inthe request from the first user device and a user profile. The one ormore instructions, when executed by the one or more processors, maycause the one or more processors to determine that an authenticationcode is needed to authenticate the request received from the first userdevice to access the protected resource based on verifying the useridentity of the user of the first user device. The one or moreinstructions, when executed by the one or more processors, may cause theone or more processors to dynamically generate a plurality of codesbased on determining that the authentication code is needed toauthenticate the request received from the first user device to accessthe protected resource. A first code, of the plurality of codes, maycorrespond to a correct authentication code needed to authenticate therequest received from the first user device to access the protectedresource. The one or more instructions, when executed by the one or moreprocessors, may cause the one or more processors to store the pluralityof codes in a storage device, determine a second user device associatedwith the user identity of the user of the first user device afterverifying the user identity of the user of the first user device, andtransmit the plurality of codes to the second user device associatedwith the user identity of the user of the first user device. The one ormore instructions, when executed by the one or more processors, maycause the one or more processors to transmit, to a third user deviceassociated with the user identity of the user of the first user device,a message including an instruction for identifying the correctauthentication code from among the plurality of codes. The one or moreinstructions, when executed by the one or more processors, may cause theone or more processors to transmit, to the first user device, anauthentication request that includes a request for the correctauthentication code. The one or more instructions, when executed by theone or more processors, may cause the one or more processors to receive,from the first user device, a response to the authentication requestthat includes a second code, compare the second code and the first code,and selectively authenticate the request from the first user device toaccess the protected resource based on a result of comparing the secondcode and the first code selectively grant access to the first userdevice to access the protected resource.

BRIEF DESCRIPTION OF THE DRAWINGS

FIGS. 1A-1E are diagrams of an example implementation described herein.

FIG. 2 is a diagram of an example environment in which systems and/ormethods, described herein, may be implemented.

FIG. 3 is a diagram of example components of one or more devices of FIG.2.

FIG. 4 is a flow chart of an example process for performing multi-factorauthentication.

FIG. 5 is a flow chart of an example process for performing multi-factorauthentication.

FIG. 6 is a flow chart of an example process for performing multi-factorauthentication.

DETAILED DESCRIPTION

The following detailed description of example implementations refers tothe accompanying drawings. The same reference numbers in differentdrawings may identify the same or similar elements.

Authentication methods that depend on more than one factor forauthentication are more difficult to compromise than single-factormethods. As a result, more and more providers of protected resources,such as financial services providers, banking providers, credit cardproviders, and/or the like, are requiring multi-factor authentication ofa user's identity before allowing the user to gain access to theprotected resource.

The user may be asked to provide a username and password as one factorfor authentication. The user may be asked to provide an additionalfactor for authentication, which may be in the form of providing and/orcorrectly identifying a one-time code sent to a device (e.g., a mobiledevice, smartphone, computer, etc.) assumed to be in the user'spossession. The one-time code, however, may be compromised in instancesof the code being sent to multiple, shared devices associated with theuser (e.g., a smartphone and a tablet, etc.). Additionally, sincedevices can be cloned, and/or a service provider's personnel may haveaccess to read a message including the one-time code, it is no longersafe to assume that the device receiving the one-time code, and/or themessage including the one-time code, is only in the user's possession.

Some implementations described herein provide an authenticationplatform, which may include an authentication device, configured toimplement multi-factor authentication to authenticate a user identity ofa user requesting access to a protected resource (e.g., access to aprotected device, web access to protected content, and/or the like)before allowing the user to access the protected resource. The user,using a first user device, may request access to the protected resourceand, in the request, supply certain credentials to the authenticationplatform. The credentials may serve as a first factor forauthentication, and may include, for example, a username and password,biometric information, and/or the like.

Upon verification of the user's identity using the first factor forauthentication, the authentication platform may dynamically generate aplurality of codes, one of which corresponds to a correct authenticationcode to be used as a second factor for authentication of the user'sidentity. The remaining codes in the plurality of codes may serve asdecoy codes, which will prevent access to the protected resource ifpresented to the authentication server as the second factor forauthentication. The user may be sent, at the first user device, a seconduser device, a third user device, etc., an instruction for identifyingthe correct authentication code from among the plurality of codes to beused as the second factor for authentication. The instruction may beknowledge-based (e.g., based on the user's knowledge) or otherwiserequire some level of discernment on behalf of the user in order toidentify the correct authentication code to present to theauthentication platform as the second factor for authentication. In thisway, the level of security associated with performing multi-factorauthentication using dynamically generated codes increases by virtue ofthe user having to discern the correct authentication code among themultiple decoy codes.

In some implementations, the authentication platform may additionallystore the plurality of codes for comparison to an incorrectauthentication code received from the user device for use in detectingpotential instances of fraud or malicious attempts at obtaining accessto the protected resource. For example, if the incorrect authenticationcode corresponds to one of the decoy codes in the plurality of codes,then a provider of the protected resource may determine or infer thatthe user device receiving the codes may be compromised and, thus,require the use of an additional factor for authenticating the user'sidentity. Further, if the incorrect authentication code does notcorrespond to one of the decoy codes in the plurality of codes, then theprovider of the protected resource may determine or infer that theattempted authentication is an attempt by a hacker to guess the correctauthentication code. In this case, further security actions may beimplemented by the provider, such as, for example, locking the user outof an account to prevent access to the protected resource until a timeat which the user's identity can be authenticated. In this way, theprovider of the protected resource may increase the efficiencyassociated with assessing and/or reacting to fraudulent requests.

FIGS. 1A-1E are diagrams of an example implementation 100 describedherein. As shown in FIGS. 1A-1E, example implementation 100 may includea first user device, a second user device (not shown in FIG. 1A), anauthentication platform that may communicate with the first user deviceand the second user device, and a protected device having access toprotected content or information. The authentication platform mayinclude a code generator configured to dynamically generateauthentication codes and a storage device configured to store data(e.g., profile information, the dynamically generated codes, etc.)associated with performing multi-factor authentication as describedherein.

As shown in FIG. 1A, and by reference number 102, a user of the firstuser device may request access to the protected device. The request maybe received by the authentication platform. In some implementations, therequest includes credentials for use in performing multi-factorauthentication by the authentication platform as described herein. Theprotected device may include, for example, a device containing orstoring protected content, information, and/or resources, such as anATM, a server device hosting protected content, a computer containing adata structure including protected content, a flash drive, and/or thelike. In some implementations, the user of the first user device mayrequest access to a protected resource, such as, for example, a resourcedisposed in a secure area (e.g., of a building, a vault, etc.), webaccess to a secure website, and/or the like. As an example, the user ofthe first user device may request access to protected content, such asmoney, information (e.g., identity information, financial or bankinginformation, credit card information, health records, etc.), property(e.g., jewelry, art, etc.), and/or the like.

In some implementations, the authentication platform may be configuredto authenticate a user identity of the user of the first user devicethat is making the request to access the protected device. For example,the authentication platform may authenticate the user identity of theuser of the first user device by implementing multi-factorauthentication prior to granting the user access to the protecteddevice. In some implementations, the request to access the protecteddevice may include credentials, which may be used as a first factor inauthenticating the user's identity according to the multi-factorauthentication technique or procedure employed by the authenticationplatform. The credentials may include, for example, a username andpassword, biometric information, and/or the like. As an example, thebiometric information may be associated with the user of the first userdevice, which may include any biological trait that identifies the user,such as a fingerprint, hand geometry, retina or iris pattern, voicesignature, facial pattern, and/or the like.

As further shown in FIG. 1A, and by reference number 104, theauthentication platform may verify the user identity of the user of thefirst user device by comparing the credentials received in the requestfrom the first user device and information contained in a user profile.In some implementations, the user profile may include informationcontained in a data structure accessible to the authentication platform.In some implementations, the data structure may be local or remote fromthe authentication platform. In some implementations, the data structuremay contain information to verify the credentials, such as biometricinformation or the username and password, which may be compared ormatched to the credentials received in the request by the authenticationplatform.

As further shown in FIG. 1A, and by reference number 106, theauthentication platform may determine that an authentication code isneeded to authenticate the request received from the first user deviceto access the protected device. For example, the authentication platformmay determine that the authentication code is needed based on verifyingthe user identity of the user of the first user device. In someimplementations, the authentication platform may determine that theauthentication code is needed based on a lookup in a set of predefinedrules or executing predefined instructions that instruct theauthentication platform to perform multi-factor authentication based onat least two authentication factors, one factor including thecredentials and the other factor being conditioned upon receipt of acorrect authentication code.

In some implementations, the authentication platform may recognize thatthe first user device is a trusted device (e.g., the authenticationplatform has previously performed multi-factor authentication andrecognizes that the user is using the first user device to provide thefirst factor), and the predefined rules or instructions may instruct theauthentication platform to skip multi-factor authentication. In someimplementations, the authentication platform may recognize that a userhas disabled or turned off (e.g., using a mobile application or website)the feature requiring multi-factor authentication, and the predefinedrules or instructions may instruct the authentication platform to skipmulti-factor authentication when the feature has been turned off. Insome implementations, the feature requiring multi-factor authenticationcannot be turned off, and the authentication platform is instructed toperform multi-factor authentication each time the first user devicerequests access to the protected device. In some implementations, thepredefined rules or instructions may instruct the authenticationplatform to perform multi-factor authentication even in instances wherethe user has turned the feature off and/or in instances where the firstuser device is a trusted device. For example, if the authenticationplatform determines that the first user device is making the request toaccess the protected device from an abnormal location (e.g., ageographic region or area that does not correspond to locations of wherethe user is typically located), then the predefined rules orinstructions may instruct the authentication platform to performmulti-factor authentication to authenticate the user's identity. In someinstances, the authentication platform may be aware of and/or haveaccess to real-time (or near real-time) location information associatedwith the user (e.g., based on knowledge of credit card purchases, ATMusage, the user physically entering a banking branch to request atransaction, etc.) and/or the first user device (e.g., based on anapplication executing on the first user device), and may be instructedto perform multi-factor authentication when the user and/or the firstuser device is in an abnormal location compared to the location of wherethe user and/or the first user device are typically located or have beenpreviously determined to be located.

In some implementations, the predefined rules or instructions mayinstruct the authentication platform to perform multi-factorauthentication for instances in which there is at least one failedattempt at providing the first factor. For example, the predefined rulesor instructions may instruct the authentication platform to performmulti-factor authentication upon incorrect entry of the username, thepassword, or the username and the password. In some implementations, thepredefined rules or instructions may specify a time period that a userdevice may be considered as trusted. Upon expiration of the specifiedtime, the authentication platform would be instructed to preformmulti-factor authentication to authentication the user identity of theuser of the first user device.

In some implementations, where the user attempts to access the protecteddevice using a mobile application executing on the first user device,the application could monitor general activity on the first user deviceand instruct the authentication platform to perform multi-factorauthentication based on this activity. For example, if an unauthorizeduser were to access the first user device and search around forusernames and/or passwords, then the authentication platform maydetermine (e.g., using the predefined rules or instructions and activitylevel information received from the application) to require multi-factorauthentication based on increased activity. In some implementations, theuser may opt-in to sharing information captured by other applicationsexecuting on the first user device (e.g., health monitoringapplications, etc.). In instances where the application detects theuser's heart-rate or breathing rapidly increasing, the authenticationplatform may determine that the user is under duress and requiremulti-factor authentication.

In some implementations, an authentication model may be trained andtested, using machine learning, to determine whether to performmulti-factor authentication. In this case, the authentication platformmay receive, as input, any one or any combination of the above describedfactors when determining to perform multi-factor authentication. Forexample, the authentication platform may use the authentication modelthat receives, as input, activity level(s) associated with the userdevice, location information associated with the user and/or the firstuser device, real-time information, failed attempt information, healthinformation, and/or the like, and calculates a risk score. When therisk-score satisfies a given threshold, the authentication platform mayperform multi-factor authentication of the user's identity.

As further shown in FIG. 1A, and by reference number 108, theauthentication platform may determine a second user device associatedwith the user of the first user device. In some implementations, thesecond user device may receive an authentication code for use inauthenticating the user's identity according to the multi-factorauthentication technique being implemented by the authenticationplatform. In some implementations, the authentication platform maydetermine a list of user devices, one of which includes the second userdevice, based on examining a user profile. The user profile may or maynot include the same profile used to verify the user's identity based onthe credentials as described herein. In some instances, theauthentication platform may prompt the user of the first user device toselect the second user device from a list of user devices included inthe prompt and/or otherwise prompt the user to specify a method ofsending the authentication code to the second user device for use inperforming the multi-factor authentication of the user's identity. Forexample, the authentication platform may prompt the user of the firstuser device to select which device (e.g., a computer, laptop, tablet,mobile device, smartphone, wearable computing device, etc.) to send theauthentication code to, and to select how to send the authenticationcode (e.g., a SMS text message, a MMS multimedia message, an electronicmail (e-mail) message, an audio message, an audio file, etc.). In thisway, the user of the first user device may communicate the preferreddevice and method of receiving the authentication code to theauthentication platform. In some implementations, the authenticationcode may correspond to a correct authentication code identified and/orselected from a plurality of codes as described herein.

In some implementations, the authentication platform may select whichuser devices, in the list of user devices, to present to the user indetermining the second user device. For example, the authenticationplatform may determine that the user has two, three, four, etc., userdevices registered with the authentication platform and that one or moreof the user devices are trusted. In this case, the authenticationplatform may filter the list and present a list of trusted user devicesto the user for use in selecting the second user device. As anotherexample, the authentication platform may select the list of user devicesto present to the user based on a location at which the user ispredicted and/or determined to be. For example, if the user is predictedor determined to be at a home location (e.g., based on comparing thereal-time user location and address information contained the userprofile), the authentication platform may filter the list and present alist of geographically related user devices so that other user devices(e.g., a work computer, etc.) would be excluded from the list. Further,if the authentication platform determines that the user is travelingaway from home, the authentication platform may exclude non-portableuser devices (e.g., work computers, desktops, etc.) from the list.

As shown in FIG. 1B, and by reference number 110, the authenticationplatform may generate a plurality of codes based on determining that anauthentication code is needed to authenticate the request received fromthe first user device to access the protected device. For example, theplurality of codes may be generated by a code generator accessible tothe authentication platform. In this case, the code generator may belocal or remote from the authentication platform. In someimplementations, a first code, of the plurality of codes, may correspondto a correct authentication code needed to authenticate the requestreceived from the first user device to access the protected device. Inthis case, the remaining codes, of the plurality of codes, maycorrespond to decoy codes which will prevent the first user device fromaccessing the protected device if presented to the authenticationplatform.

In some implementations, the code generator may employ a pseudo-randomcode generator to dynamically generate a plurality of pseudo-randomcodes. For example, the pseudo-random codes may include numbers and/orletters. In this case, the correct authentication code and the decoycodes may each include pseudo-random codes. That is, the correctauthentication code and the decoy codes may each be a pseudo-random codethat is devoid of user-specific attributes. In some implementations, thecode generator may access user data in creating the correctauthentication code of the plurality of codes. For example, the codegenerator may access user-specific attributes or data and place theattributes in a randomized location (e.g., the middle, the beginning, orthe end of the string of code) of the correct authentication code.Example user-specific attributes may include the user's birth day, birthmonth, birth year, most recent transaction value, address, zip code,area code, age, social security number (or a portion thereof), creditcard number (or a portion thereof), credit score, and/or the like.

As a particular example, the user may have a birthday on January 15. Inthis case, the code generator may generate a correct authentication codethat includes the number “15”, which is an example of a user-basedattribute. Example codes that the code generator may generate as thecorrect authentication code based on the user-based attribute “15” mayinclude 12315, 51563, 15349, and/or the like, in which each example codeincludes the number “15”. For codes that contain and/or are generatedbased on user-specific attributes, the user may be sent aknowledge-based instruction for use in determining the correctauthentication code from among the plurality of codes as later describedherein. In some implementations, the codes dynamically generated by theauthentication platform may expire after a predetermined amount of timeto increase the security level associated with the multi-factorauthentication technique or process being implemented by theauthentication platform.

As further shown in FIG. 1B, and by reference number 112, theauthentication platform may store the first code, which corresponds tothe correct authentication code, in a storage device accessible to theauthentication platform for use in selectively authenticating therequest from the first user device to access the protected device, aslater described herein. In this case, the storage device may be local orremote from the authentication platform. In some implementations, theauthentication platform may store each of the plurality of codes in thestorage device accessible to the authentication platform. In this way,the authentication platform may analyze incorrect authentication codesreceived from user devices in an effort to potentially identify cases inwhich a user device is compromised and/or whether there is a maliciousattempt to access the protected resource as described later herein. Thismay improve the security associated with performing multi-factorauthentication by the authentication platform.

As further shown in FIG. 1B, and by reference number 114, theauthentication platform may transmit the plurality of codes to thesecond user device. In some implementations, the plurality of codes maybe transmitted according to the method specified by the user of thefirst user device. For example, the authentication platform may transmitthe plurality of codes in a SMS text message, a MMS multimedia message,an e-mail message, an audio message, an audio file, and/or the like.

In some implementations, receiving the plurality of codes in an audiomessage and/or an audio file may be preferred in instances where theuser may be hearing impaired. In some implementations, receiving theplurality of codes in an audio message and/or an audio file may bepreferred in instances where the plurality of codes may be visuallyperceived by other, unintended recipients. For example, theauthentication platform may, using location information and/or the like,determine that the user is located in a heavily populated area (e.g., asports complex, an arena, a bus, a subway car, etc.) where a messageshowing visual codes (e.g. a text message, etc.) may be easily seen byothers. The authentication platform may determine to send the pluralityof codes as an audio message or in an audio file where the user may useheadphones to listen to the plurality of codes. Sending the plurality ofcodes by way of an audio file may increase the security associated withsending the plurality of codes and performing multi-factorauthentication based on receiving a correct authentication code, bypreventing others from seeing the plurality of codes.

As shown in FIG. 1C, and by reference number 116, the authenticationplatform may transmit a message that includes an instruction foridentifying the correct authentication code from among the plurality ofcodes sent to the second user device. The authentication platform maysend the message to the first user device for display at the first userdevice, to the second user device for display at the second user device,to a third user device for display at the third user device, and/or thelike. In some implementations, sending the message to the first userdevice for display at the first user device may increase the securitylevel associated with sending the plurality of codes, as the useridentity of the user of the first user device has been verified usingcredentials as described above. In some implementations, sending themessage to the second user device for display at the second user devicemay increase the security level associated with sending the plurality ofcodes, as performing the multi-level authentication invokes the use ofmore than one user device. In some implementations, sending the messageto a third user device, that is different from the first and second userdevices, for display at the third user device may increase the securitylevel associated with sending the plurality of codes, as performing themulti-level authentication invokes the use of more than two userdevices.

In some implementations, the instruction for identifying the correctauthentication code from among the plurality of codes may be anon-knowledge based instruction. For example, the instruction mayinstruct the user to identify the correct authentication code based on aspecified order of the correct authentication code relative to othercodes in the plurality of codes. As an example, the instruction mayinstruct the user to pick “the first code” in a list of codes, pick “thethird code” in a list of codes, pick “the middle code” in a list ofcodes, pick “the last code” in a list of codes, and/or the like. Asanother example, the instruction may instruct the user to identify thecorrect authentication code based on the correct authentication codehaving a relative value compared to other codes in the plurality ofcodes. For example, the instruction may instruct the user to pick thecode having the “lowest” value among the plurality of codes, the“highest” value from among the plurality of codes, and/or the like.

In some implementations, the instruction for identifying the correctauthentication code from among the plurality of codes may be aknowledge-based instruction whereby the correct authentication codeincludes or contains the user-specific attribute as described above, andis determinable based on the knowledge-based instruction. For example,the instruction may instruct the user to identify the correctauthentication code based on the correct authentication code containingthe user's day of birth, year of birth, month of birth, age, value oftheir last purchase, value of their last ATM withdrawal, value of theirlast deposit, value of their last paycheck, and/or the like. In thiscase, the correct authentication code may include a specified sequenceof digits compared to other codes in the plurality of codes. Forexample, the specified sequence of digits may correspond to the user'sday of birth, year of birth, month of birth, area code, address, and/orthe like. In this way, the authentication platform may instruct the userto select the correct authorization code from among the plurality ofcodes by selecting the code that includes the specified sequence ofdigits.

In some implementations, the instruction for identifying the correctauthentication code from among the plurality of codes, may betransmitted from the authentication platform to the first user device,the second user device, and/or the like as a SMS text message, a pop-upmessage, a MMS multimedia message, an e-mail message, an audio message,an audio file, and/or the like. As an example, the instruction foridentifying the correct authentication code may be transmitted to thefirst user device as a pop-up message instructing the user to enter thecorrect authentication code from the second user device, where thecorrect authentication code is the “lowest” number or value among theplurality of codes, the “third code” among the plurality of codes, thecode including the user's birth month among the plurality of codes,and/or the like as described above. Sending the message instructing theuser on how to decipher the correct authorization code from the decoycodes to the first user device may increase the security associated withperforming multi-factor authentication using dynamically generatedcodes.

In some implementations, sending the message instructing the user on howto decipher the correct authorization code from the decoy codes in anaudio message and/or an audio file may be preferred in instances wherethe user may be hearing impaired. In some implementations, sending themessage instructing the user on how to decipher the correctauthorization code from the decoy codes may be preferred in instanceswhere the message containing the instruction may be visually perceivedby other, unintended recipients. For example, the authenticationplatform may, using location information and/or the like, determine thatthe user is located in a heavily populated area, where a message thatvisually depicts the instruction may be accessible to others. Theauthentication platform may determine to send the message instructingthe user on how to decipher the correct authorization code from thedecoy codes as an audio message or in an audio file, where the user mayuse headphones to listen to the message. Sending the message instructingthe user on how to decipher the correct authorization code from thedecoy codes by way of an audio message or an audio file may increase thesecurity associated with performing multi-factor authentication based onreceiving a correct authentication code by preventing others from seeingthe message and/or instruction for deciphering the correct code.

As shown in FIG. 1D, and by reference number 118, the authenticationplatform may transmit an authentication request to the first user devicebased on determining that an authentication code is needed toauthenticate the request from the first user device to access theprotected device. For example, the authentication request may include arequest for the correct authentication code. As shown by referencenumber 120, the authentication platform may receive, from the first userdevice, a response to the authentication request that includes a secondcode based on the request for the correct authentication code. As shownby reference number 122, the authentication platform may compare thesecond code received from the first user device and the first codestored in the storage device. As noted earlier, the first code beingstored in the storage device may correspond to the correctauthentication code. As shown by reference number 124, theauthentication platform may selectively authenticate (e.g., authenticateor decline to authenticate) the request from the first user device toaccess the protected device based on a result of comparing the secondcode and the first code, to selectively grant the first user deviceaccess to the protected device.

As shown in FIG. 1E, and by reference number 126, the authenticationplatform may permit the first user device to access the protected deviceif the request is authenticated (i.e., the first code matches the secondcode). Alternatively, as shown by reference number 128, where the secondcode does not match the first code, the authentication platform mayperform a declined action based on declining to authenticate the requestfrom the first user device to access the protected device. As anexample, the declined action may include authenticating the request fromthe first user device to access the protected device by requesting theuser to present a different factor for authentication. As anotherexample, the declined action may include affording the user anadditional opportunity to identify a correct authentication code basedon a newly generated set of codes. As a further example, the declinedaction may include locking the user out of an account associated withthe protected device.

In some implementations, the declined action may include analyzing thesecond code to try to predict or identify the reason for the failedauthentication. As an example, if the second code was one of the decoycodes in the plurality of codes, then the authentication platform mayinform the provider that the second user device may be compromised. Asanother example, if the second code was similar to the correctauthentication code (e.g., one digit away from the correctauthentication code, etc.), then the authentication platform maydetermine that the user may have incorrectly transcribed the code, andoffer the user another chance at authentication. As a further example,if the second code was not one of the decoy codes, then the request toaccess the protected device may be labeled or identified by theauthentication platform as a potential attempt by a hacker to guess thecorrect authentication code. In this case, further security actions maybe implemented, such as locking the user out of an account to preventaccess to the protected resource until the user's identity can beauthenticated in a more secure method.

In this way, some implementations described herein may increase thelevel of security associated with performing multi-factor authenticationof a user's identity using an authentication code. For example, thelevel of security may increase by virtue of generating and sending auser a plurality of codes (e.g., one correct authentication code andmultiple decoy codes), and sending a message instructing the user how todiscern the correct authentication code from among multiple decoy codes.The level of security may further increase where the correctauthentication code includes a user-specific attribute. Furthermore,potential cases of fraud and/or malicious attempts at obtainingprotected information from the protected device may be more quicklydetected based on analyzing the incorrect authentication codes suppliedto the authentication platform.

In some implementations, the authentication platform may processthousands, millions, billions, or more authentication requests,simultaneously, or within a given period of time. Considering the largenumber of authentication requests and information (e.g., lists of userdevices, code generation, instructions to decipher the codes, etc.) usedto perform multi-factor authentication of a user's identity, thegeneration and management of multiple codes by the authenticationplatform enhances the efficiency at which access to a protected deviceor resource is performed.

As indicated above, FIGS. 1A-1E are provided merely as an example. Otherexamples are possible and may differ from what was described with regardto FIGS. 1A-1E.

FIG. 2 is a diagram of an example environment 200 in which systemsand/or methods, described herein, may be implemented. As shown in FIG.2, environment 200 may include a first user device 210, a second userdevice 220, a cloud computing environment 230, an authenticationplatform 240, a computing resource 245, a protected device 250, and anetwork 260. Devices of environment 200 may interconnect via wiredconnections, wireless connections, or a combination of wired andwireless connections.

First user device 210 includes one or more devices capable of sending,receiving, generating, storing, processing, and/or providing informationassociated with performing multi-factor authentication by anauthentication platform (e.g., authentication platform 240). Forexample, first user device 210 may include a communication and/orcomputing device, such as a mobile phone (e.g., a smart phone, aradiotelephone, etc.), a laptop computer, a tablet computer, a handheldcomputer, a gaming device, a wearable communication device (e.g., asmart wristwatch, a pair of smart eyeglasses, etc.), or a similar typeof device.

Second user device 220 includes one or more devices capable of sending,receiving, generating, storing, processing, and/or providing informationassociated with performing multi-factor authentication by theauthentication platform (e.g., authentication platform 240). Forexample, second user device 220 may include a communication and/orcomputing device, such as a mobile phone (e.g., a smart phone, aradiotelephone, etc.), a laptop computer, a tablet computer, a handheldcomputer, a gaming device, a wearable communication device (e.g., asmart wristwatch, a pair of smart eyeglasses, etc.), or a similar typeof device.

Cloud computing environment 230 includes an environment that deliverscomputing as a service, whereby shared resources, services, etc., may beprovided to an authentication platform (e.g., authentication platform240). Cloud computing environment 230 may provide computation, software,data access, storage, and/or other services that do not require end-userknowledge of a physical location and configuration of a system and/or adevice that delivers the services. In some implementations, as shown,authentication platform 240 may be hosted in cloud computing environment230. Notably, while implementations described herein describeauthentication platform 240 as being hosted in cloud computingenvironment 230, in some implementations, authentication platform 240may not be cloud-based or may be partially cloud-based.

Authentication platform 240 includes one or more devices capable ofsending, receiving, processing, determining, providing, and/or otherwiseperforming multi-factor authentication of user identities forauthenticating or declining to authenticate requests by first userdevice 210 to access protected device 250. Authentication platform 240may include one or more code generator devices capable of dynamicallygenerating codes for use in the multi-factor authentication of useridentities for authenticating or declining to authenticate requests byfirst user device 210 to access protected device 250. In someimplementations, authentication platform 240 may include a server deviceor a group of server devices.

Computing resource 245 includes one or more personal computers,workstation computers, server devices, or another type of computationand/or communication device. In some implementations, computing resource245 may host authentication platform 240. The cloud resources mayinclude compute instances executing in computing resource 245, storagedevices provided in computing resource 245, data transfer devicesprovided by computing resource 245, etc. In some implementations,computing resource 245 may communicate with other computing resources245 via wired connections, wireless connections, or a combination ofwired and wireless connections.

As further shown in FIG. 2, computing resource 245 may include a groupof cloud resources, such as one or more applications (“APPs”) 245-1, oneor more virtual machines (“VMs”) 245-2, virtualized storage (“VSs”)245-3, one or more hypervisors (“HYPs”) 245-4, or the like.

Application 245-1 includes one or more software applications that may beprovided to or accessed by first user device 210, second user device220, and/or the like. Application 245-1 may eliminate a need to installand execute the software applications on first user device 210, seconduser device 220, and/or the like. For example, application 245-1 mayinclude software associated with authentication platform 240 and/or anyother software capable of being provided via cloud computing environment230. In some implementations, one application 245-1 may send/receiveinformation to/from one or more other applications 245-1, via virtualmachine 245-2.

Virtual machine 245-2 includes a software implementation of a machine(e.g., a computer) that executes programs like a physical machine.Virtual machine 245-2 may be either a system virtual machine or aprocess virtual machine, depending upon use and degree of correspondenceto any real machine by virtual machine 245-2. A system virtual machinemay provide a complete system platform that supports execution of acomplete operating system (“OS”). A process virtual machine may executea single program, and may support a single process. In someimplementations, virtual machine 245-2 may execute on behalf of a user(e.g., using first user device 210, second user device 220, and/or thelike), and may manage infrastructure of cloud computing environment 230,such as data management, synchronization, or long-duration datatransfers.

Virtualized storage 245-3 includes one or more storage systems and/orone or more devices that use virtualization techniques within thestorage systems or devices of computing resource 245. In someimplementations, within the context of a storage system, types ofvirtualizations may include block virtualization and filevirtualization. Block virtualization may refer to abstraction (orseparation) of logical storage from physical storage so that the storagesystem may be accessed without regard to physical storage orheterogeneous structure. The separation may permit administrators of thestorage system flexibility in how the administrators manage storage forend users. File virtualization may eliminate dependencies between dataaccessed at a file level and a location where files are physicallystored. This may enable optimization of storage use, serverconsolidation, and/or performance of non-disruptive file migrations.

Hypervisor 245-4 provides hardware virtualization techniques that allowmultiple operating systems (e.g., “guest operating systems”) to executeconcurrently on a host computer, such as computing resource 245.Hypervisor 245-4 may present a virtual operating platform to the guestoperating systems, and may manage the execution of the guest operatingsystems. Multiple instances of a variety of operating systems may sharevirtualized hardware resources.

Protected device 250 includes one or more devices capable of sending,receiving, storing, providing, hosting, processing, and/or facilitatingprovision of a protected resource or content to a user accessing a userdevice (e.g., first user device 210). For example, protected device 250may include one or more servers and/or computers configured to storeand/or provide protected resources, content, or information associatedwith the user of the user device (e.g., first user device 210). Uponauthentication of the identity of the user of the user device (e.g.,first user device 210) by authentication platform 240, the user mayaccess protected device 250.

Network 260 includes one or more wired and/or wireless networks. Forexample, network 260 may include a cellular network (e.g., a long-termevolution (LTE) network, a code division multiple access (CDMA) network,a 3G network, a 4G network, a 5G network, another type of nextgeneration network, etc.), a public land mobile network (PLMN), a localarea network (LAN), a wide area network (WAN), a metropolitan areanetwork (MAN), a telephone network (e.g., the Public Switched TelephoneNetwork (PSTN)), a private network, an ad hoc network, an intranet, theInternet, a fiber optic-based network, a cloud computing network, or thelike, and/or a combination of these or other types of networks.

The number and arrangement of devices and networks shown in FIG. 2 areprovided as an example. In practice, there may be additional devicesand/or networks, fewer devices and/or networks, different devices and/ornetworks, or differently arranged devices and/or networks than thoseshown in FIG. 2. Furthermore, two or more devices shown in FIG. 2 may beimplemented within a single device, or a single device shown in FIG. 2may be implemented as multiple, distributed devices. Additionally, oralternatively, a set of devices (e.g., one or more devices) ofenvironment 200 may perform one or more functions described as beingperformed by another set of devices of environment 200.

FIG. 3 is a diagram of example components of a device 300. Device 300may correspond to first user device 210, second user device 220,authentication platform 240, computing resource 245, and/or protecteddevice 250. In some implementations, first user device 210, second userdevice 220, authentication platform 240, computing resource 245, and/orprotected device 250 may include one or more devices 300 and/or one ormore components of device 300. As shown in FIG. 3, device 300 mayinclude a bus 310, a processor 320, a memory 330, a storage component340, an input component 350, an output component 360, and acommunication interface 370.

Bus 310 includes a component that permits communication among thecomponents of device 300. Processor 320 is implemented in hardware,firmware, or a combination of hardware and software. Processor 320 is acentral processing unit (CPU), a graphics processing unit (GPU), anaccelerated processing unit (APU), a microprocessor, a microcontroller,a digital signal processor (DSP), a field-programmable gate array(FPGA), an application-specific integrated circuit (ASIC), or anothertype of processing component. In some implementations, processor 320includes one or more processors capable of being programmed to perform afunction. Memory 330 includes one or more memories such as a randomaccess memory (RAM), a read only memory (ROM), and/or another type ofdynamic or static storage device (e.g., a flash memory, a magneticmemory, and/or an optical memory) that stores information and/orinstructions for use by processor 320.

Storage component 340 stores information and/or software related to theoperation and use of device 300. For example, storage component 340 mayinclude a hard disk (e.g., a magnetic disk, an optical disk, amagneto-optic disk, and/or a solid state disk), a compact disc (CD), adigital versatile disc (DVD), a floppy disk, a cartridge, a magnetictape, and/or another type of non-transitory computer-readable medium,along with a corresponding drive.

Input component 350 includes a component that permits device 300 toreceive information, such as via user input (e.g., a touch screendisplay, a keyboard, a keypad, a mouse, a button, a switch, and/or amicrophone). Additionally, or alternatively, input component 350 mayinclude a sensor for sensing information (e.g., a global positioningsystem (GPS) component, an accelerometer, a gyroscope, and/or anactuator). Output component 360 includes a component that providesoutput information from device 300 (e.g., a display, a speaker, and/orone or more light-emitting diodes (LEDs)).

Communication interface 370 includes a transceiver-like component (e.g.,a transceiver and/or a separate receiver and transmitter) that enablesdevice 300 to communicate with other devices, such as via a wiredconnection, a wireless connection, or a combination of wired andwireless connections. Communication interface 370 may permit device 300to receive information from another device and/or provide information toanother device. For example, communication interface 370 may include anEthernet interface, an optical interface, a coaxial interface, aninfrared interface, a radio frequency (RF) interface, a universal serialbus (USB) interface, a Wi-Fi interface, a cellular network interface, orthe like.

Device 300 may perform one or more processes described herein. Device300 may perform these processes based on processor 320 executingsoftware instructions stored by a non-transitory computer-readablemedium, such as memory 330 and/or storage component 340. Acomputer-readable medium is defined herein as a non-transitory memorydevice. A memory device includes memory space within a single physicalstorage device or memory space spread across multiple physical storagedevices.

Software instructions may be read into memory 330 and/or storagecomponent 340 from another computer-readable medium or from anotherdevice via communication interface 370. When executed, softwareinstructions stored in memory 330 and/or storage component 340 may causeprocessor 320 to perform one or more processes described herein.Additionally, or alternatively, hardwired circuitry may be used in placeof or in combination with software instructions to perform one or moreprocesses described herein. Thus, implementations described herein arenot limited to any specific combination of hardware circuitry andsoftware.

The number and arrangement of components shown in FIG. 3 are provided asan example. In practice, device 300 may include additional components,fewer components, different components, or differently arrangedcomponents than those shown in FIG. 3. Additionally, or alternatively, aset of components (e.g., one or more components) of device 300 mayperform one or more functions described as being performed by anotherset of components of device 300.

FIG. 4 is a flow chart of an example process 400 for performingmulti-factor authentication. In some implementations, one or moreprocess blocks of FIG. 4 may be performed by an authentication platform(e.g., authentication platform 240). In some implementations, one ormore process blocks of FIG. 4 may be performed by another device or agroup of devices separate from or including the authentication platform,such as a first user device (e.g., first user device 210), a second userdevice (e.g., second user device 220), and/or a protected device (e.g.,protected device 250).

As shown in FIG. 4, process 400 may include receiving a request from afirst user device to access a protected device, wherein the request fromthe first user device includes user credentials, and wherein the usercredentials are associated with a user identity of a user of the firstuser device (block 405). For example, an authentication platform (e.g.,authentication platform 240, using computing resource 245, processor320, memory 330, storage component 340, input component 350,communication interface 370, and/or the like) may receive a request froma first user device to access a protected device, as described above inconnection with FIGS. 1A-1E. In some implementations, the request fromthe first user device may include user credentials. In someimplementations, the user credentials may be associated with a useridentity of a user of the first user device.

As further shown in FIG. 4, process 400 may include verifying the useridentity of the user of the first user device based on comparing theuser credentials received in the request from the first user device anda user profile (block 410). For example, the authentication platform(e.g., authentication platform 240, using computing resource 245,processor 320, memory 330, storage component 340, communicationinterface 370, and/or the like) may verify the user identity of the userof the first user device based on comparing the user credentialsreceived in the request from the first user device and a user profile,as described above in connection with FIGS. 1A-1E.

As further shown in FIG. 4, process 400 may include determining that anauthentication code is needed to authenticate the request received fromthe first user device to access the protected device based on verifyingthe user identity of the user of the first user device (block 415). Forexample, the authentication platform (e.g., authentication platform 240,using computing resource 245, processor 320, memory 330, storagecomponent 340, and/or the like) may determine that an authenticationcode is needed to authenticate the request received from the first userdevice to access the protected device based on verifying the useridentity of the user of the first user device, as described above inconnection with FIGS. 1A-1E.

As further shown in FIG. 4, process 400 may include dynamicallygenerating a plurality of codes based on determining that theauthentication code is needed to authenticate the request received fromthe first user device to access the protected device, wherein a firstcode, of the plurality of codes, corresponds to a correct authenticationcode needed to authenticate the request received from the first userdevice to access the protected device (block 420). For example, theauthentication platform (e.g., authentication platform 240, usingcomputing resource 245, processor 320, memory 330, storage component340, and/or the like) may dynamically generate a plurality of codesbased on determining that the authentication code is needed toauthenticate the request received from the first user device to accessthe protected device, as described above in connection with FIGS. 1A-1E.In some implementations, a first code, of the plurality of codes, maycorrespond to a correct authentication code needed to authenticate therequest received from the first user device to access the protecteddevice.

As further shown in FIG. 4, process 400 may include determining a seconduser device associated with the user identity of the user of the firstuser device after verifying the user identity (block 425). For example,the authentication platform (e.g., authentication platform, usingcomputing resource 245, processor 320, memory 330, storage component340, communication interface 370, and/or the like) may determine asecond user device associated with the user identity of the user of thefirst user device after verifying the user identity, as described abovein connection with FIGS. 1A-1E.

As further shown in FIG. 4, process 400 may include transmitting theplurality of codes to the second user device associated with the useridentity of the user of the first user device (block 430). For example,the authentication platform (e.g., authentication platform 240, usingcomputing resource 245, processor 320, memory 330, storage component340, output component 360, communication interface 370, and/or the like)may transmit the plurality of codes to the second user device associatedwith the user identity of the user of the first user device, asdescribed above in connection with FIGS. 1A-1E.

As further shown in FIG. 4, process 400 may include transmitting amessage including an instruction for identifying the correctauthentication code from among the plurality of codes (block 435). Forexample, the authentication platform (e.g., authentication platform 240,using computing resource 245, processor 320, memory 330, storagecomponent 340, communication interface 370, output component 360, and/orthe like) may transmit a message including an instruction foridentifying the correct authentication code from among the plurality ofcodes, as described above in connection with FIGS. 1A-1E.

As further shown in FIG. 4, process 400 may include transmitting, to thefirst user device, an authentication request that includes a request forthe correct authentication code (block 440). For example, theauthentication platform (e.g., authentication platform 240, usingcomputing resource 245, processor 320, memory 330, storage component340, output component 360, communication interface 370, and/or the like)may transmit, to the first user device, an authentication request thatincludes a request for the correct authentication code, as describedabove in connection with FIGS. 1A-1E.

As further shown in FIG. 4, process 400 may include receiving, from thefirst user device, a response to the authentication request thatincludes a second code (block 445). For example, the authenticationplatform (e.g., authentication platform 240, using computing resource245, processor 320, memory 330, storage component 340, input component350, communication interface 370, and/or the like) may receive, from thefirst user device, a response to the authentication request thatincludes a second code, as described above in connection with FIGS.1A-1E.

As further shown in FIG. 4, process 400 may include comparing the secondcode and the first code (block 450). For example, the authenticationplatform (e.g., authentication platform 240, using computing resource245, processor 320, memory 330, storage component 340, and/or the like)may compare the second code and the first code, as described above inconnection with FIGS. 1A-1E.

As further shown in FIG. 4, process 400 may include selectivelyauthenticating the request from the first user device to access theprotected device, based on a result of comparing the second code and thefirst code, to selectively grant the first user device access to theprotected device (block 455). For example, the authentication platform(e.g., authentication platform 240, using computing resource 245,processor 320, memory 330, storage component 340, output component 360,communication interface 370, and/or the like) may selectivelyauthenticate the request from the first user device to access theprotected device, based on a result of comparing the second code and thefirst code, to selectively grant the first user device access to theprotected device, as described above in connection with FIGS. 1A-1E.

Process 400 may include additional implementations, such as any singleimplementation or any combination of implementations described belowand/or in connection with one or more other processes describedelsewhere herein.

In some implementations, the second code may correspond to one of theplurality of codes transmitted to the second user device. In someimplementations, the message, including the instruction for identifyingthe correct authentication code from among the plurality of codes, maybe transmitted to the first user device for display by the first userdevice. In some implementations, the message, including the instructionfor identifying the correct authentication code from among the pluralityof codes, may include a first instruction that identifies the correctauthentication code as having a specified order relative to other codesin the plurality of codes, a second instruction that identifies thecorrect authentication code as having a relative value compared to othercodes in the plurality of codes, and/or a third instruction thatidentifies the correct authentication code as having a specifiedsequence of digits compared to other codes in the plurality of codes. Insome implementations, the message, including the instruction foridentifying the correct authentication code from among the plurality ofcodes, may include a text message, a pop-up message, a multimediamessage, an electronic mail message, and/or an audio message.

In some implementations, the instruction, for identifying the correctauthentication code from among the plurality of codes, may betransmitted to the second user device for display by the second userdevice. In some implementations, the instruction, for identifying thecorrect authentication code from among the plurality of codes, mayinclude a knowledge-based instruction whereby the correct authenticationcode includes a user-specific attribute determinable based on theknowledge-based instruction. In some implementations, process 400 mayfurther include storing the plurality of codes in a storage device. Insome implementations, process 400 may further include comparing thesecond code, received in the response to the authentication request fromthe first user device, and the plurality of codes stored in the storagedevice to detect a malicious attempt to access the protected device.

Although FIG. 4 shows example blocks of process 400, in someimplementations, process 400 may include additional blocks, fewerblocks, different blocks, or differently arranged blocks than thosedepicted in FIG. 4. Additionally, or alternatively, two or more of theblocks of process 400 may be performed in parallel.

FIG. 5 is a flow chart of an example process 500 for performingmulti-factor authentication. In some implementations, one or moreprocess blocks of FIG. 5 may be performed by an authentication platform(e.g., authentication platform 240). In some implementations, one ormore process blocks of FIG. 5 may be performed by another device or agroup of devices separate from or including the authentication platform,such as a first user device (e.g., first user device 210), a second userdevice (e.g., second user device 220), a computing resource (e.g.,computing resource 245), and/or a protected device (e.g., protecteddevice 250).

As shown in FIG. 5, process 500 may include receiving a request from afirst user device to access a protected device, wherein the request fromthe first user device includes user credentials, and wherein the usercredentials are associated with a user identity of a user of the firstuser device (block 505). For example, the authentication platform (e.g.,authentication platform 240, using computing resource 245, processor320, memory 330, storage component 340, input component 350,communication interface 370, and/or the like) may receive a request froma first user device to access a protected device, as described above inconnection with FIGS. 1A-1E. In some implementations, the request fromthe first user device may include user credentials. In someimplementations, the user credentials may be associated with a useridentity of a user of the first user device.

As further shown in FIG. 5, process 500 may include verifying the useridentity of the user of the first user device based on comparing theuser credentials received in the request from the first user device anda user profile (block 510). For example, the authentication platform(e.g., authentication platform 240, using computing resource 245,processor 320, memory 330, storage component 340, communicationinterface 370, and/or the like) may verify the user identity of the userof the first user device based on comparing the user credentialsreceived in the request from the first user device and a user profile,as described above in connection with FIGS. 1A-1E.

As further shown in FIG. 5, process 500 may include determining that anauthentication code is needed to authenticate the request received fromthe first user device to access the protected device based on verifyingthe user identity of the user of the first user device (block 515). Forexample, the authentication platform device (e.g., authenticationplatform 240, using computing resource 245, processor 320, memory 330,storage component 340, communication interface 370, and/or the like) maydetermine that an authentication code is needed to authenticate therequest received from the first user device to access the protecteddevice based on verifying the user identity of the user of the firstuser device, as described above in connection with FIGS. 1A-1E.

As further shown in FIG. 5, process 500 may include dynamicallygenerating a plurality of codes based on determining that theauthentication code is needed to authenticate the request received fromthe first user device to access the protected device, wherein a firstcode, of the plurality of codes, corresponds to a correct authenticationcode needed to authenticate the request received from the first userdevice to access the protected device (block 520). For example, theauthentication platform (e.g., authentication platform 240, usingcomputing resource 245, processor 320, memory 330, storage component340, and/or the like) may dynamically generate a plurality of codesbased on determining that the authentication code is needed toauthenticate the request received from the first user device to accessthe protected device, as described above in connection with FIGS. 1A-1E.In some implementations, a first code, of the plurality of codes, maycorrespond to a correct authentication code needed to authenticate therequest received from the first user device to access the protecteddevice.

As further shown in FIG. 5, process 500 may include determining a seconduser device associated with the user identity of the user of the firstuser device after verifying the user identity of the user of the firstuser device (block 525). For example, the authentication platform (e.g.,authentication platform 240, using computing resource 245, processor320, memory 330, storage component 340, communication interface 370,and/or the like) may determine a second user device associated with theuser identity of the user of the first user device after verifying theuser identity of the user of the first user device, as described abovein connection with FIGS. 1A-1E.

As further shown in FIG. 5, process 500 may include transmitting theplurality of codes to the second user device associated with the useridentity of the user of the first user device (block 530). For example,the authentication platform (e.g., authentication platform 240, usingcomputing resource 245, processor 320, memory 330, storage component340, output component 360, communication interface 370, and/or the like)may transmit the plurality of codes to the second user device associatedwith the user identity of the user of the first user device, asdescribed above in connection with FIGS. 1A-1E.

As further shown in FIG. 5, process 500 may include transmitting amessage to the first user device, wherein the message includes aninstruction for identifying the correct authentication code from amongthe plurality of codes, and wherein the message is configured fordisplay on the first user device (block 535). For example, theauthentication platform (e.g., authentication platform 240, usingcomputing resource 245, processor 320, memory 330, storage component340, output component 360, communication interface 370, and/or the like)may transmit a message to the first user device, as described above inconnection with FIGS. 1A-1E. In some implementations, the message mayinclude an instruction for identifying the correct authentication codefrom among the plurality of codes. In some implementations, the messagemay be configured for display on the first user device.

As further shown in FIG. 5, process 500 may include transmitting, to thefirst user device, an authentication request that includes a request forthe correct authentication code (block 540). For example, theauthentication platform (e.g., authentication platform 240, usingcomputing resource 245, processor 320, memory 330, storage component340, output component 360, communication interface 370, and/or the like)may transmit, to the first user device, an authentication request thatincludes a request for the correct authentication code, as describedabove in connection with FIGS. 1A-1E.

As further shown in FIG. 5, process 500 may include receiving, from thefirst user device, a response to the authentication request thatincludes a second code (block 545). For example, the authenticationplatform device (e.g., using computing resource 245, processor 320,memory 330, storage component 340, input component 350, communicationinterface 370, and/or the like) may receive, from the first user device,a response to the authentication request that includes a second code, asdescribed above in connection with FIGS. 1A-1E.

As further shown in FIG. 5, process 500 may include comparing the secondcode and the first code (block 550). For example, the authenticationplatform device (e.g., using computing resource 245, processor 320,memory 330, storage component 340, and/or the like) may compare thesecond code and the first code, as described above in connection withFIGS. 1A-1E.

As further shown in FIG. 5, process 500 may include selectivelyauthenticating the request from the first user device to access theprotected device based on a result of comparing the second code and thefirst code to selectively grant the first user device access to theprotected device (block 555). For example, the authentication platform(e.g., authentication platform 240, using computing resource 245,processor 320, memory 330, storage component 340, communicationinterface 370, and/or the like) may selectively authenticate the requestfrom the first user device to access the protected device based on aresult of comparing the second code and the first code to selectivelygrant the first user device access to the protected device, as describedabove in connection with FIGS. 1A-1E.

Process 500 may include additional implementations, such as any singleimplementation or any combination of implementations described belowand/or in connection with one or more other processes describedelsewhere herein.

In some implementations, the instruction, for identifying the correctauthentication code from among the plurality of codes, may include afirst instruction that identifies the correct authentication code ashaving a specified order relative to other codes in the plurality ofcodes, a second instruction that identifies the correct authenticationcode as having a relative value compared to other codes in the pluralityof codes, and/or a third instruction that identifies the correctauthentication code as having a specified sequence of digits compared toother codes in the plurality of codes. In some implementations, theinstruction, for identifying the correct authentication code from amongthe plurality of codes, may include a knowledge-based instructionwhereby the correct authentication code includes a user-specificattribute determinable based on the knowledge-based instruction. In someimplementations, the message, including the instruction for identifyingthe correct authentication code from among the plurality of codes, mayinclude a text message, a pop-up message, a multimedia message, anelectronic mail message, or an audio message. In some implementations,the device may include a storage device. In some implementations, theplurality of codes may be stored in the storage device.

Although FIG. 5 shows example blocks of process 500, in someimplementations, process 500 may include additional blocks, fewerblocks, different blocks, or differently arranged blocks than thosedepicted in FIG. 5. Additionally, or alternatively, two or more of theblocks of process 500 may be performed in parallel.

FIG. 6 is a flow chart of an example process 600 for performingmulti-factor authentication. In some implementations, one or moreprocess blocks of FIG. 6 may be performed by an authentication platform(e.g., authentication platform 240). In some implementations, one ormore process blocks of FIG. 6 may be performed by another device or agroup of devices separate from or including the authentication platform(e.g., authentication platform 240), such as a first user device (e.g.,first user device 210), a second user device (e.g., second user device220), a computing resource (e.g., computing resource 245), and/or aprotected device (e.g., protected device 250).

As shown in FIG. 6, process 600 may include receiving a request from afirst user device to access a protected device, wherein the request fromthe first user device includes user credentials, and wherein the usercredentials are associated with a user identity of a user of the firstuser device (block 605). For example, the authentication platform (e.g.,authentication platform 240, using computing resource 245, processor320, memory 330, storage component 340, input component 350,communication interface 370, and/or the like) may receive a request froma first user device to access a protected resource, as described abovein connection with FIGS. 1A-1E. In some implementations, the requestfrom the first user device may include user credentials. In someimplementations, the user credentials may be associated with a useridentity of a user of the first user device.

As further shown in FIG. 6, process 600 may include verifying the useridentity of the user of the first user device based on comparing theuser credentials received in the request from the first user device anda user profile (block 610). For example, the authentication platform(e.g., authentication platform 240, using computing resource 245,processor 320, memory 330, storage component 340, communicationinterface 370, and/or the like) may verify the user identity of the userof the first user device based on comparing the user credentialsreceived in the request from the first user device and a user profile,as described above in connection with FIGS. 1A-1E.

As further shown in FIG. 6, process 600 may include determining that anauthentication code is needed to authenticate the request received fromthe first user device to access the protected device based on verifyingthe user identity of the user of the first user device (block 615). Forexample, the authentication platform (e.g., authentication platform 240,using computing resource 245, processor 320, memory 330, storagecomponent 340, communication interface 370, and/or the like) maydetermine that an authentication code is needed to authenticate therequest received from the first user device to access the protectedresource based on verifying the user identity of the user of the firstuser device, as described above in connection with FIGS. 1A-1E.

As further shown in FIG. 6, process 600 may include dynamicallygenerating a plurality of codes based on determining that theauthentication code is needed to authenticate the request received fromthe first user device to access the protected device, wherein a firstcode, of the plurality of codes, corresponds to a correct authenticationcode needed to authenticate the request received from the first userdevice to access the protected device (block 620). For example, theauthentication platform (e.g., authentication platform 240, usingcomputing resource 245, processor 320, memory 330, storage component340, communication interface 370, and/or the like) may dynamicallygenerate a plurality of codes based on determining that theauthentication code is needed to authenticate the request received fromthe first user device to access the protected resource, as describedabove in connection with FIGS. 1A-1E. In some implementations, a firstcode, of the plurality of codes, may correspond to a correctauthentication code needed to authenticate the request received from thefirst user device to access the protected resource.

As further shown in FIG. 6, process 600 may include storing theplurality of codes in a storage device (block 625). For example, theauthentication platform (e.g., authentication platform 240, usingcomputing resource 245, processor 320, memory 330, storage component340, and/or the like) may store the plurality of codes in a storagedevice, as described above in connection with FIGS. 1A-1E.

As further shown in FIG. 6, process 600 may include determining a seconduser device associated with the user identity of the user of the firstuser device after verifying the user identity of the user of the firstuser device (block 630). For example, the authentication platform (e.g.,authentication platform 240, using computing resource 245, processor320, memory 330, storage component 340, communication interface 370,and/or the like) may determine a second user device associated with theuser identity of the user of the first user device after verifying theuser identity of the user of the first user device, as described abovein connection with FIGS. 1A-1E.

As further shown in FIG. 6, process 600 may include transmitting theplurality of codes to the second user device associated with the useridentity of the user of the first user device (block 635). For example,the authentication platform (e.g., authentication platform 240, usingcomputing resource 245, processor 320, memory 330, storage component340, output component 360, communication interface 370, and/or the like)may transmit the plurality of codes to the second user device associatedwith the user identity of the user of the first user device, asdescribed above in connection with FIGS. 1A-1E.

As further shown in FIG. 6, process 600 may include transmitting, to athird user device associated with the user identity of the user of thefirst user device, a message including an instruction for identifyingthe correct authentication code from among the plurality of codes (block640). For example, the authentication platform (e.g., authenticationplatform 240, using computing resource 245, processor 320, memory 330,storage component 340, output component 360, communication interface370, and/or the like) may transmit, to a third user device associatedwith the user identity of the user of the first user device, a messageincluding an instruction for identifying the correct authentication codefrom among the plurality of codes, as described above in connection withFIGS. 1A-1E.

As further shown in FIG. 6, process 600 may include transmitting, to thefirst user device, an authentication request that includes a request forthe correct authentication code (block 645). For example, theauthentication platform (e.g., authentication platform 240, usingcomputing resource 245, processor 320, memory 330, storage component340, output component 360, communication interface 370, and/or the like)may transmit, to the first user device, an authentication request thatincludes a request for the correct authentication code, as describedabove in connection with FIGS. 1A-1E.

As further shown in FIG. 6, process 600 may include receiving, from thefirst user device, a response to the authentication request thatincludes a second code (block 650). For example, the authenticationplatform (e.g., authentication platform 240, using computing resource245, processor 320, memory 330, storage component 340, input component350, communication interface 370, and/or the like) may receive, from thefirst user device, a response to the authentication request thatincludes a second code, as described above in connection with FIGS.1A-1E.

As further shown in FIG. 6, process 600 may include comparing the secondcode and the first code (block 655). For example, the authenticationplatform (e.g., authentication platform 240, using computing resource245, processor 320, memory 330, storage component 340, communicationinterface 370, and/or the like) may compare the second code and thefirst code, as described above in connection with FIGS. 1A-1E.

As further shown in FIG. 6, process 600 may include selectivelyauthenticating the request from the first user device to access theprotected device based on a result of comparing the second code and thefirst code to selectively grant the first user device access to theprotected device (block 660). For example, the authentication platformdevice (e.g., authentication platform 240, using computing resource 245,processor 320, memory 330, storage component 340, communicationinterface 370, and/or the like) may selectively authenticate the requestfrom the first user device to access the protected resource based on aresult of comparing the second code and the first code selectively grantaccess to the first user device to access the protected resource, asdescribed above in connection with FIGS. 1A-1E.

Process 600 may include additional implementations, such as any singleimplementation or any combination of implementations described belowand/or in connection with one or more other processes describedelsewhere herein.

In some implementations, process 600 may further include generating theinstruction for identifying the correct authentication code from amongthe plurality of codes. In some implementations, the instruction mayinclude a first instruction that indicates the correct authenticationcode as having a specified order relative to other codes in theplurality of codes, a second instruction that indicates the correctauthentication code as having a relative value compared to other codesin the plurality of codes, and/or a third instruction that indicates thecorrect authentication code as having a specified sequence of digitscompared to other codes in the plurality of codes. In someimplementations, the instruction may include a knowledge-basedinstruction whereby the correct authentication code includes auser-specific attribute to be determined based on the knowledge-basedinstruction.

In some implementations, process 600 may further include transmittingthe message, including the instruction for identifying the correctauthentication code from among the plurality of codes, as a textmessage, a pop-up message, a multimedia message, an electronic mailmessage, or an audio message. In some implementations, the third userdevice may be the first user device. In some implementations, process600 may further include declining to authenticate the request from thefirst user device to access the protected resource, and analyzing thesecond code received in the response to the authentication request fromthe first user device by comparing the second code to the plurality ofcodes stored in the storage device to detect a malicious attempt toaccess the protected resource

Although FIG. 6 shows example blocks of process 600, in someimplementations, process 600 may include additional blocks, fewerblocks, different blocks, or differently arranged blocks than thosedepicted in FIG. 6. Additionally, or alternatively, two or more of theblocks of process 600 may be performed in parallel.

In this way, the level of security for performing multi-factorauthentication is increased by generating a plurality of codes andinstructing the user to deciphering the correct authentication code fromthe plurality of codes. Further, potential cases of fraud or maliciousattempts at obtaining protected information may be more quickly detectedbased on analyzing the incorrect authentication codes supplied to theauthentication platform. As an example, if the code was one of theincorrect decoy codes, then the user device receiving the codes may becompromised. As another example, if the incorrect authentication codewas one digit away from the correct authentication code, then the usermay have incorrectly transcribed the code, and may be offered anotherchance at authentication. As another example, if the incorrectauthentication code was not one of the incorrect decoy codes, it may beidentified as an attempt by a hacker to guess the correct authenticationcode. In this case, further security actions may be implemented, such aslocking the user out of an account to prevent access to the protectedresource until the user's identity can be authenticated in a more secureway.

The foregoing disclosure provides illustration and description, but isnot intended to be exhaustive or to limit the implementations to theprecise form disclosed. Modifications and variations are possible inlight of the above disclosure or may be acquired from practice of theimplementations.

As used herein, the term component is intended to be broadly construedas hardware, firmware, or a combination of hardware and software.

Some implementations are described herein in connection with thresholds.As used herein, satisfying a threshold may refer to a value beinggreater than the threshold, more than the threshold, higher than thethreshold, greater than or equal to the threshold, less than thethreshold, fewer than the threshold, lower than the threshold, less thanor equal to the threshold, equal to the threshold, or the like.

Certain user interfaces have been described herein and/or shown in thefigures. A user interface may include a graphical user interface, anon-graphical user interface, a text-based user interface, or the like.A user interface may provide information for display. In someimplementations, a user may interact with the information, such as byproviding input via an input component of a device that provides theuser interface for display. In some implementations, a user interfacemay be configurable by a device and/or a user (e.g., a user may changethe size of the user interface, information provided via the userinterface, a position of information provided via the user interface,etc.). Additionally, or alternatively, a user interface may bepre-configured to a standard configuration, a specific configurationbased on a type of device on which the user interface is displayed,and/or a set of configurations based on capabilities and/orspecifications associated with a device on which the user interface isdisplayed.

It will be apparent that systems and/or methods, described herein, maybe implemented in different forms of hardware, firmware, or acombination of hardware and software. The actual specialized controlhardware or software code used to implement these systems and/or methodsis not limiting of the implementations. Thus, the operation and behaviorof the systems and/or methods were described herein without reference tospecific software code—it being understood that software and hardwarecan be designed to implement the systems and/or methods based on thedescription herein.

Even though particular combinations of features are recited in theclaims and/or disclosed in the specification, these combinations are notintended to limit the disclosure of possible implementations. In fact,many of these features may be combined in ways not specifically recitedin the claims and/or disclosed in the specification. Although eachdependent claim listed below may directly depend on only one claim, thedisclosure of possible implementations includes each dependent claim incombination with every other claim in the claim set.

No element, act, or instruction used herein should be construed ascritical or essential unless explicitly described as such. Further, asused herein, the articles “a” and “an” are intended to include one ormore items, and may be used interchangeably with “one or more.”Furthermore, as used herein, the term “set” is intended to include oneor more items (e.g., related items, unrelated items, a combination ofrelated and unrelated items, etc.), and may be used interchangeably with“one or more.” Where only one item is intended, the term “one” orsimilar language is used. Further, as used herein, the terms “has,”“have,” “having,” or the like are intended to be open-ended terms.Further, the phrase “based on” is intended to mean “based, at least inpart, on” unless explicitly stated otherwise.

What is claimed is:
 1. A method, comprising: receiving, by a processor,a first request from a first user device to access a protected device,the first request including user credentials, and the user credentialsbeing associated with a user identity associated with the first userdevice; verifying, by the processor, the user identity based oncomparing the user credentials received in the first request and a userprofile; determining, by the processor, that an authentication code isneeded to authenticate the first request to access the protected devicebased on verifying the user identity; dynamically generating, by theprocessor, a plurality of codes based on determining that theauthentication code is needed to authenticate the first request toaccess the protected device, a first code, of the plurality of codes,corresponding to a correct authentication code needed to authenticatethe first request to access the protected device, the first code beinggenerated using a first pseudo-random code based on user-specific data,one or more second codes, of the plurality of codes, corresponding toone or more decoy codes, and the one or more second codes beinggenerated using one or more second pseudo-random codes; determining, bythe processor, a second user device associated with the user identityafter verifying the user identity; transmitting, by the processor, theplurality of codes to the second user device; transmitting, by theprocessor, a message including an instruction for identifying thecorrect authentication code from among the plurality of codes using theuser-specific data; transmitting, by the processor and to the first userdevice, an authentication request that includes a second request for thecorrect authentication code, the correct authentication code to beidentified, based on the authentication request, using the instruction;receiving, by the processor and from the first user device, a responseto the authentication request that includes a third code; comparing, bythe processor, the third code and the plurality of codes; determining,by the processor and based on the third code matching one of the one ormore second codes, that the second user device is compromised;notifying, by the processor and based on determining that the seconduser device is compromised, a provider associated with the protecteddevice that the second user device is compromised; and requesting, bythe processor and based on determining that the second user device iscompromised, an additional factor for authenticating the user identity.2. The method of claim 1, wherein the message, including the instructionfor identifying the correct authentication code from among the pluralityof codes, is transmitted to the first user device for display by thefirst user device.
 3. The method of claim 2, wherein the message,including the instruction for identifying the correct authenticationcode from among the plurality of codes, includes: a first instructionthat identifies the correct authentication code as having a specifiedorder relative to other codes in the plurality of codes, a secondinstruction that identifies the correct authentication code as having arelative value compared to other codes in the plurality of codes, or athird instruction that identifies the correct authentication code ashaving a specified sequence of digits compared to other codes in theplurality of codes.
 4. The method of claim 1, wherein the instruction istransmitted to the second user device for display by the second userdevice.
 5. The method of claim 4, wherein the instruction includes aknowledge-based instruction whereby the correct authentication codeincludes the user-specific data determinable based on theknowledge-based instruction.
 6. The method of claim 1, furthercomprising: storing the plurality of codes in a storage device.
 7. Themethod of claim 1, wherein the message, including the instruction foridentifying the correct authentication code from among the plurality ofcodes, is one of: a text message, a pop-up message, a multimediamessage, an electronic mail message, or an audio message.
 8. A device,comprising: one or more memories; and one or more processors,communicatively coupled to the one or more memories, to: receive a firstrequest from a first user device to access a protected device, the firstrequest including user credentials, and the user credentials beingassociated with a user identity associated with the first user device;verify the user identity based on comparing the user credentialsreceived in the first request and a user profile; determine that anauthentication code is needed to authenticate the first request toaccess the protected device based on verifying the user identity;dynamically generate a plurality of codes based on determining that theauthentication code is needed to authenticate the first request toaccess the protected device, a first code, of the plurality of codes,corresponding to a correct authentication code needed to authenticatethe first request to access the protected device, the first code beinggenerated using a first pseudo-random code based on user-specific data,one or more second codes, of the plurality of codes, corresponding toone or more decoy codes, and the one or more second codes beinggenerating using one or more second pseudo-random codes; determine asecond user device associated with the user identity after verifying theuser identity; transmit the plurality of codes to the second userdevice; transmit a message to the first user device, the messageincluding an instruction for identifying the correct authentication codefrom among the plurality of codes using the user-specific data, and themessage being configured for display on the first user device; transmit,to the first user device, an authentication request that includes asecond request for the correct authentication code, the correctauthentication code to be identified, based on the authenticationrequest, using the instruction; receive, from the first user device, aresponse to the authentication request that includes a third code;compare the third code and: the first code, and the one or more secondcodes; determine, based on the third code matching one of the one ormore second codes, that the second user device is comprised; provide, toa provider associated with the protected device and based on determiningthat the second user device is compromised, a notification that thesecond user device is compromised; and request, based on determiningthat the second user device is compromised, an additional factor forauthenticating the user identity.
 9. The device of claim 8, wherein theinstruction includes: a first instruction that identifies the correctauthentication code as having a specified order relative to other codesin the plurality of codes, a second instruction that identifies thecorrect authentication code as having a relative value compared to othercodes in the plurality of codes, or a third instruction that identifiesthe correct authentication code as having a specified sequence of digitscompared to other codes in the plurality of codes.
 10. The device ofclaim 8, wherein the instruction includes a knowledge-based instructionwhereby the correct authentication code includes the user-specific datadeterminable based on the knowledge-based instruction.
 11. The device ofclaim 8, wherein the message, including the instruction for identifyingthe correct authentication code from among the plurality of codes, isone of: a text message, a pop-up message, a multimedia message, anelectronic mail message, or an audio message.
 12. The device of claim 8,wherein the device comprises a storage device, and wherein the pluralityof codes is stored in the storage device.
 13. A non-transitorycomputer-readable medium storing instructions, the instructionscomprising: one or more instructions that, when executed by one or moreprocessors, cause the one or more processors to: receive a first requestfrom a first user device to access a protected resource, the firstrequest including user credentials, and the user credentials beingassociated with a user identity associated with the first user device;verify the user identity based on comparing the user credentialsreceived in the first request and a user profile; determine that anauthentication code is needed to authenticate the first request toaccess the protected resource based on verifying the user identity;dynamically generate a plurality of codes based on determining that theauthentication code is needed to authenticate the first request toaccess the protected resource, a first code, of the plurality of codes,corresponding to a correct authentication code needed to authenticatethe first user device to access the protected resource, the first codebeing generated using a first pseudo-random code based on user-specificdata, one or more second codes, of the plurality of codes, correspondingto one or more decoy codes, and the one or more second codes beinggenerated using one or more second pseudo-random codes; store theplurality of codes in a storage device; determine a second user deviceassociated with the user identity after verifying the user identity;transmit the plurality of codes to the second user device; transmit, toa third user device associated with the user identity, a messageincluding an instruction for identifying the correct authentication codefrom among the plurality of codes using the user-specific data;transmit, to the first user device, an authentication request thatincludes a second request for the correct authentication code, thecorrect authentication code to be identified, based on theauthentication request, using the instruction for identifying thecorrect authentication code from among the plurality of codes; receive,from the first user device, a response to the authentication requestthat includes a third code; compare the third code and the plurality ofcodes; determine, based on the third code matching one of the one ormore second codes, that the second user device is compromised; andnotify, based on determining that the second user device is compromised,a provider of the protected resource that the second user device iscompromised.
 14. The non-transitory computer-readable medium of claim13, wherein the one or more instructions, when executed by the one ormore processors, further cause the one or more processors to: generatethe instruction for identifying the correct authentication code fromamong the plurality of codes, the instruction, for identifying thecorrect authentication code from among the plurality of codes, includingone of: a first instruction that indicates the correct authenticationcode as having a specified order relative to other codes in theplurality of codes, a second instruction that indicates the correctauthentication code as having a relative value compared to other codesin the plurality of codes, or a third instruction that indicates thecorrect authentication code as having a specified sequence of digitscompared to other codes in the plurality of codes.
 15. Thenon-transitory computer-readable medium of claim 13, wherein the one ormore instructions, when executed by the one or more processors, furthercause the one or more processors to: generate the instruction foridentifying the correct authentication code from among the plurality ofcodes, the instruction, for identifying the correct authentication codefrom among the plurality of codes, including a knowledge-basedinstruction whereby the correct authentication code includes theuser-specific data to be determined based on the knowledge-basedinstruction.
 16. The non-transitory computer-readable medium of claim13, wherein the one or more instructions, that cause the one or moreprocessors to transmit the message, cause the one or more processors to:transmit the message as a text message, a pop-up message, a multimediamessage, an electronic mail message, or an audio message.
 17. Thenon-transitory computer-readable medium of claim 13, wherein the thirduser device is the first user device.
 18. The non-transitorycomputer-readable medium of claim 13, wherein the one or moreinstructions, when executed by the one or more processors, further causethe one or more processors to: decline, based on a result of comparingthe third code and the first code, to authenticate the first request toaccess the protected resource.
 19. The method of claim 1, furthercomprising: receiving a fourth code from the first user device;comparing the fourth code and the plurality of codes; and locking, basedon the fourth code not matching the first code and not matching the oneor more second codes, a user, of the first user device, out of anaccount associated with the protected device.
 20. The method of claim 1,further comprising: receiving a fourth code from the first user device;comparing the fourth code and the plurality of codes; determining, basedon comparing the fourth code and the plurality of codes, that the fourthcode does not match the first code; determining, based on comparing thefourth code and the plurality of codes, that the fourth code comprises athreshold similarity to the first code; and transmitting, to the firstuser device, another authentication request.